Investment Committee memo
Investment Committee Memo
Discover every AI agent. Govern what it does. Prove it.
Executive Summary
Avanor is building the neutral third-party attestation layer for autonomous enterprise AI agents. As AI shifts from chat interfaces to agentic execution (making API calls, executing financial transactions, modifying production infrastructure), GRC and security teams face a trust gap: LLM logs are non-deterministic, self-reported, and vulnerable to prompt injection or agent hallucination.
Avanor provides real-time policy gating and offline-verifiable audit bundles. Every action a policy denies at the enforcement gate is sealed into a SHA-256 hash chain and rolled into a daily Merkle root, so a customer's auditor can re-verify it without trusting Avanor.
Key Investment Thesis
Unavoidable Market Timing. Enterprise adoption of AI agents is blocked not by model capability, but by GRC and security governance. Companies cannot deploy agents with write-access to enterprise APIs without audit-ready proof of what the agent did, why it did it, and who authorized it.
Neutral 3rd-Party Moat. Agents cannot audit themselves. Avanor is the independent cryptographic witness. Buyers and their auditors need attestation that sits outside the agent's own LLM provider.
Top-Decile Execution Velocity. Since incorporating in March 2026, solo technical founder Logan built a working cryptographic audit architecture, secured pipeline with mid-market enterprises, and assembled a world-class advisory board.
Product & Technical Architecture
Real-Time Policy Gating. Evaluates agent API tool calls before execution against enterprise compliance rules and returns an allow or deny decision. The four-eyes kill switch is the halt mechanism live today; enforcing denies inline is in build.
Merkle-Tree Audit Ledger. Each sealed record commits the attempted action, the policy in force, its version, and the gate's verdict into a per-tenant SHA-256 hash chain, with each day's entries rolled up under a Merkle root. Request payloads and captured inputs are deliberately excluded from the hash so the seal survives a crypto-shred.
Offline Verifiability. Verified offline by internal GRC teams or external regulators, without exposing the underlying data.
Traction & Enterprise Pipeline
Active Enterprise GRC Review. A 2,800-person enterprise SaaS company: $45,000 pilot proposal, 3-month rollout, in internal GRC review with their Head of GRC.
Active Discovery Pipeline. Enterprise technical discovery underway with contacts at three further enterprises across social, revenue-ops, and telecom.
Accelerators & Programs. Y Combinator application submitted with a demo-ready build; no acceptances to date.
Team
AI-native technical founder. Built the Avanor governance platform solo on ~$100/mo.
Weaver IT Advisory Sr. Manager and IAPP Austin chair, joining full-time (GTM & GRC) on close. CISA, CDPSE, CIPT, AIGP.
25+ yr security & privacy leader. CPSO at Eloqua (acquired by Oracle ~$871M). DHS Privacy Committee chair. Advisor (FAST, 0.5%).
The Ask
50% Engineering (founding eng)|20% GTM & GRC|15% Security & SOC 2|15% Infra & compute